PHP to Release Urgent Security Patches for Two Critical Vulnerabilities

Image: Ars Technica · Source

PHP maintainers plan to release emergency patches for two high-severity vulnerabilities with a score of 9.2, addressing an exploit named PHP2Shell that allows remote code execution on multiple PHP-based platforms.

PHP, a widely used open-source scripting language powering many websites and applications, is set to release emergency security patches for two critical vulnerabilities. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, have been rated with a severity score of 9.2 out of 10 by PHP maintainers. The patch release is expected imminently, with warnings that details or proof of active exploitation could prompt an earlier release.

An unverified report surfaced alongside a demonstration video of an exploit tool called PHP2Shell, which reportedly allows remote code execution on web servers running various PHP-based content management systems and applications. These include popular platforms such as WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel versions 8.83.29 and 13.36.0, Symphony 8.1.9, Drupal 11.4.10, and WHMCS 9.0.9.

Security firm watchTowr indicated that these vulnerabilities affect every PHP version starting from PHP 5, released in 2004, and has independently confirmed their authenticity. Multiple security firms, including Sansec, Webfence, and Huntress, have issued warnings, with Sansec predicting mass exploitation attempts shortly after the patches are published.

Administrators are urged to prepare proactively by identifying those responsible for PHP maintenance, inventorying PHP-based applications, scheduling a maintenance window—recommended to begin at 14:00 UTC, but possibly earlier—and ensuring full backups of websites and databases are ready. Experts also recommend monitoring the official PHP.net website closely for updates or accelerated patch release.

Because PHP is integral to millions of websites and internal tools worldwide—estimated at 1.3 million internet-connected hosts potentially vulnerable—the impact of these security flaws could be extensive. Organizations are advised to consider temporarily disconnecting non-essential systems until patches are applied. Vigilance remains crucial as the patches may be published at any time to mitigate active threats.